Re: [PATCH] futexs: fix infinite loop in get_futex_key on huge page

Thomas Gleixner
2009-07-11T10:17:17Z

On Sat, 11 Jul 2009, Ingo Molnar wrote:
>
> * Sonny Rao <sonnyrao@us.ibm.com> wrote:
>
> > get_futex_key() can infinitely loop if it is called on a virtual
> > address that is within a huge page but not aligned to the
> > beginning of that page. The call to get_user_pages_fast will
> > return the struct page for a sub-page within the huge page and the
> > check for page->mapping will always fail.
> >
> > The fix is to call compound_head on the page before checking that
> > it's mapped.
> >
> > Signed-off-by: Sonny Rao <sonnyrao@us.ibm.com>
> > Cc: Ingo Molnar <mingo@redhat.com>
> > Cc: stable@kernel.org
> >
> > Index: linux-2.6.31-rc2/kernel/futex.c
> > ===================================================================
> > --- linux-2.6.31-rc2.orig/kernel/futex.c 2009-07-10 17:45:46.181084475 -0500
> > +++ linux-2.6.31-rc2/kernel/futex.c 2009-07-10 17:46:47.345084062 -0500
> > @@ -247,6 +247,7 @@
> > if (err < 0)
> > return err;
> >
> > + page = compound_head(page);
> > lock_page(page);
> > if (!page->mapping) {
> > unlock_page(page);
>
> Nice catch! Applied it to tip:core/urgent - Thomas, do you agree
> with the fix?

Acked-by-me.